Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098997)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098997 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in sndac97controllerregister If ac97addadapter fails, putdevice is...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-099009)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099009 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Validate buflen before strnlen in sndctleleminitenumnames sndctleleminitenumnames...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098948)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098948 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: stop parsing UAC2 rates at MAXNRRATES parseuac2sampleraterange caps the number o...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098982)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098982 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to che...

CVE-2026-74682

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio driver. This vulnerability involves an out-of-bounds write, where the system attempts to write data beyond the allocated memory buffer. This occurs due to incorrect buffer sizing when processing data from...

CVE-2026-74641

A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...

CVE-2026-74639

A flaw was found in the Linux kernel, specifically within the ALSA us144mkii driver. The captureurbcomplete function resubmits capture Urban Request Blocks URBs without properly re-anchoring them. This oversight allows URBs to remain queued on the host controller even after their associated memor...

CVE-2026-74640

A flaw was found in the Linux kernel's ALSA FireWire Control Protocol FCP. An unprivileged process can trigger an out-of-bounds write by reading controls on /dev/snd/controlC0 after an oversized Level Meter map has been installed. This occurs because the fcpmeterctlget function writes beyond its...

CVE-2026-74642

A flaw was found in the ALSA USB MIDI2 EPs component of the Linux kernel. This use-after-free UAF vulnerability occurs due to a delayed release of MIDI2 endpoints, leading to an attempt to dereference an already freed Universal MIDI Packet UMP endpoint object. An attacker could potentially exploi...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Check endpoint numbers during parsing of Scarlett2 mixer interfaces The Scarlett2 mixer has a quirky behavior in the USB-audio driver; it may encounter a NULL dereference when a malformed USB descriptor is passed...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Added a clamp function in scarlett2mixerctlput Ensured that the value passed to scarlett2mixerctlput is between 0 and SCARLETT2MIXERMAXVALUE, so that we do not attempt to access elements outside of...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Check for a null pointer of the pointer substream before dereferencing it. The pointer substream is dereferenced during the assignment of the pointer to the card. Before checking if the substream is null using the macr...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fixed a mismatch in the function prototype in sndseqexpandvarevent. With Clang’s Kernel Control Flow Integrity kCFI, CONFIGCFICLANG, indirect call targets are validated against the expected function pointer prototype t...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: fixed an uninitialized flag for AV/C deferred transactions. AV/C deferred transactions were supported at commit 00a7bb81c20f “ALSA: firewire-lib: add support for deferred transactions”. However, the ‘deferrabl...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fixed an out-of-bounds bug in sndusbParseAudioInterface. There may be a faulty USB audio device with a USB ID of 0x04fa, 0x4201 and fewer than 4 interfaces. A out-of-bounds read bug occurs when parsing the...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: Fix possible null-ptr-defer in sndmts64interrupt I received a “null-ptr-defer” error report when performing the following tests on the QEMU platform: I executed the following commands: make defconfig and...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-digi00x: prevent potential use after free This code was supposed to return an error code if initstream failed, but it instead freed dg00x-rxstream and returned a success status. This could potentially lead to use o...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fixed a use-after-free in sndusbmixerfree When sndusbcreatemixer fails, sndusbmixerfree frees mixer-idelems, but the controls that were previously added to the card still reference the freed memory. Later, when...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ALSA: gus – fixed a null pointer dereferencing issue in the pointer block. The pointer block returns from sndgf1dmanextblock, and this return value could be null. Therefore, there is a potential null pointer dereferencing issue...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: jack: Access to inputdev under a mutex It is possible when using ASoC that the inputdev is not properly registered while calling sndjackreport, which can lead to a NULL pointer derefrence. To prevent this type of serialized...